CVE-2026-39836

Unscored

Advisory

Published 7 May 2026In the index since 5 Sept 2026

Severity: Unscored; worst across findings
CVSS: —; base score, highest
EPSS: 0.006; 47th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 4,006; of 17,805 indexed, latest versions
Container images: 4,576; deployed by those charts
Fix available: 1 of 1; affected package

Panic in Dial and LookupPort when handling NUL byte on Windows in net

Carried by container images the latest versions of 4,006 of 17,805 indexed charts deploy, on 4,576 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+180 more	1.25.10	4,576

OSV records: GO-2026-4971
Also known as: BIT-golang-2026-39836

Charts affected

4,006 by stars

Chart

Latest

Affected images

Radar Score

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	stdlib@go1.20.4	1.25.10
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	stdlib@go1.20.4	1.25.10

Open the chart page →

5,077

zahori-moonzahori

1.0.1

3 of 3 See more

zahori-moon zahori 1.0.1

3 of the 3 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
quay.io/aerokube/moon :2.5.1	a8837b00ba1c	stdlib@go1.20.4	1.25.10
quay.io/aerokube/moon-conf :2.5.1	9ca307b30080	stdlib@go1.20.4	1.25.10
quay.io/aerokube/moon-ui :2.0.5	89990b146824	stdlib@go1.20.5	1.25.10

Open the chart page →

2,908

zahori-schedulerzahori

1.0.1

1 of 1 See more

zahori-scheduler zahori 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
zahoriaut/zahori-scheduler :1.0.0	47d0979b1184	stdlib@go1.20.5	1.25.10

Open the chart page →

2,485

posthogzeet

0.23.2

1 of 9 See more

posthog zeet 0.23.2

1 of the 9 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.19.0	7a85f522c5bc	stdlib@go1.17.13	1.25.10

Open the chart page →

3,700

zookeeper-exporterzookeeper-exporter

0.1.0

1 of 1 See more

zookeeper-exporter zookeeper-exporter 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
dabealu/zookeeper-exporter :latest	86106fec315f	stdlib@go1.14.15	1.25.10

Open the chart page →

1,248

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
library/postgres :18.4-alpine3.24	9a8afca54e78	stdlib@go1.24.6	1.25.10

Open the chart page →

7,964

Container images carrying it

4,576 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
langgenius/dify-sandbox :0.2.0	09b7e8705673	stdlib@go1.20.6	1.25.10	2
library/arangodb :3.11.8	1e75d74954a4	stdlib@go1.21.5	1.25.10	2
library/cassandra :4.1.3	7cbcec0086ac	stdlib@go1.18.2	1.25.10	2
library/ghost :6.64.0	a31d03f1f629	stdlib@go1.24.6	1.25.10	2
library/influxdb :2.6.1-alpine	44a366dd7724	stdlib@go1.19.4	1.25.10	2
library/influxdb :2.7	b8d940ca9376	stdlib@go1.18.2	1.25.10	2
library/mariadb :10.8.3	0abf60f81588	stdlib@go1.16.7	1.25.10	2
library/mariadb :10.10	334b315c10e5	stdlib@go1.18.2	1.25.10	2
library/mariadb :12.0.2 :12.0-noble	607835cd628b	stdlib@go1.24.6	1.25.10	2
library/mariadb :11.4	611a2fcc5fa7	stdlib@go1.24.6	1.25.10	2
library/mariadb :10.6	92e50059ea0a	stdlib@go1.24.6	1.25.10	2
library/mariadb :13.0.2	d4fdec0510ad	stdlib@go1.24.6	1.25.10	2
library/mariadb :11.3.2	e101f9db3191	stdlib@go1.18.2	1.25.10	2
library/mongo :8.0.20	098862b1339f	stdlib@go1.25.7	1.25.10	2
library/mongo :5.0	41108d183e97	stdlib@go1.25.9	1.25.10	2
library/mongo :8.3.11	5d7043a4ffe0	stdlib@go1.24.6	1.25.10	2
library/mongo :7	b096b4cb9269	stdlib@go1.24.6	1.25.10	2
library/mongo :7.0	b6421fd6d1c5	stdlib@go1.24.6	1.25.10	2
library/mysql :8.2.0	212fe73edca5	stdlib@go1.18.2	1.25.10	2
library/mysql :8 :8.4.11	85b9bf2e29cf	stdlib@go1.24.6	1.25.10	2
library/mysql :8.4.2	ac80b6e09e5b	stdlib@go1.18.2	1.25.10	2
library/mysql :9.7.2	b2cf29815e62	stdlib@go1.24.6	1.25.10	2
library/nats :2.9.17-alpine	1a7b320b2942	stdlib@go1.19.9	1.25.10	2
library/nats :2.10.7-alpine	1bcddab51b80	stdlib@go1.21.5	1.25.10	2
library/nats :2.10.5-alpine	85319e5e541b	stdlib@go1.21.4	1.25.10	2
library/nats :2.8.4-alpine	988010f74b61	stdlib@go1.17.10	1.25.10	2
library/postgres :17-bookworm	051f7b7b3abd	stdlib@go1.24.6	1.25.10	2
library/postgres :16.1	09f23e02d766	stdlib@go1.18.2	1.25.10	2
library/postgres :18 :18.6-trixie	10037cee1d5e	stdlib@go1.24.6	1.25.10	2
library/postgres :18.1	1090bc3a8ccf	stdlib@go1.24.6	1.25.10	2
library/postgres :16.2	4aea012537ed	stdlib@go1.18.2	1.25.10	2
library/postgres :18.0	6f3e42ad37de	stdlib@go1.24.6	1.25.10	2
library/postgres :15-alpine	a46e076249ce	stdlib@go1.24.6	1.25.10	2
library/postgres :9.6	caddd35b05cd	stdlib@go1.16.7	1.25.10	2
library/postgres :16.4	e62fbf9d3e2b	stdlib@go1.18.2	1.25.10	2
library/postgres :13-alpine	fb9065b6e3e2	stdlib@go1.24.6	1.25.10	2
library/rabbitmq :4.1.0-management	935b3f84c1e4	stdlib@go1.22.2	1.25.10	2
library/rabbitmq :4.3.5-management :4-management :management	ffd1b50c522a	stdlib@go1.22.2	1.25.10	2
library/redis	148bb5411c18	stdlib@go1.18.2	1.25.10	2
library/redis :7.2.3	a7cee7c8178f	stdlib@go1.18.2	1.25.10	2
library/redmine :6.1.3-trixie	f474a901faec	stdlib@go1.24.6	1.25.10	2
library/traefik :v2.5	7d5a6ae66572	stdlib@go1.17.6	1.25.10	2
library/traefik :2.2.8	f5af5a5ce17f	stdlib@go1.14.6	1.25.10	2
library/zookeeper :3.9.5	f258365d4882	stdlib@go1.18.1	1.25.10	2
lightninglabs/lnd :v0.18.3-beta	f86bbec4dfb3	stdlib@go1.22.5	1.25.10	2
linuxserver/cloud9 :latest :version-1.29.2	45c5fe102ff3	stdlib@go1.17.11	1.25.10	2
listmonk/listmonk :v2.1.0	d2eac77ddfad	stdlib@go1.17.6	1.25.10	2
listmonk/listmonk :latest :v6.2.0	f535d59e1499	stdlib@go1.26.1	1.25.10	2
longhornio/longhorn-manager :v1.2.3	dca34321452c	stdlib@go1.14.1	1.25.10	2
louislam/uptime-kuma :2.3.2	9aeb4e51d038	stdlib@go1.20.5	1.25.10	2